All PHP Applications are Vulnerable

[@Chief-CO]

Born too late for PHP vulnerabilities, born too early for PHP vulnerabilities, born just in time for PHP vulnerabilities.

[@ShatteredQvartz]

At this point I'm just going to become Amish, that's the only way to be totally secure

[@MentalOutlaw]

Unfortunately there's also bugs on the farm that need patching. I have to build a roll away nesting box because my chickens discovered their own eggs are tasty

[@CheddarThief-y6o]

@@MentalOutlaw oof

[@trumpetpunk42]

It actually worked out pretty well for C0V1D...

[@ShakaFishing]

@@MentalOutlaw The chicken wire patch has yet to secure against the fox no-clip exploit.

[@ShatteredQvartz]

@@MentalOutlaw Man...

[@luca21347]

The good thing is TempleOS is still safe from all these CVEs.

[@kennnnn]

Common divine W

[@bc-cu4on]

As the Lord intended.

[@ViaScientifica]

The Lord Jesus Christ Antivirus 2000 has proven to be impenetrable.

[@ProDCloud]

Anyone can be safe if they unplug the ethernet cable.

[@fatstupid9070]

after jesus turned water to wine, he turned software vulnerabilities into history 🙏

[@Will-uv9kx]

>this bug is triggered by international conversion system Personally I blame other countries for existing

[@Smokkedandslammed]

Yeah! Let's get em!

[@walrider]

China to be precise in this case

[@werren894]

including monarchy?

[@jessequartey]

Shut up

[@stavinaircaeruleum2275]

Same.

[@kidnamedfinger.productions]

April 30: Hardware RCE affecting every every single device connected to the internet.

[@noodlez7101]

May 1st: IRL RCE that allows you to become God.

[@bsodcat]

Pov you are on TempleOS: 🗿

[@kidnamedfinger.productions]

​@@noodlez7101Considering the first neuralink brain implant was installed successfully, there's not much time left until RCE that allows you to literally get a botnet of living people under control.

[@Mitch-xo1rd]

May 30, Elon musk discovers rce irl and paywalls the sun

[@stevengill1736]

June 1st: the singularity begins, but no one notices because they're too busy watching monkey videos on Tik Tok....

[@heroslippy6666]

Ayyy Perl still on the list! 0.1% we are still under the care of the old and wise monks.

[@Wren1]

What's more surprising is that ColdFusion still exists. Like PHP, I guess they need scripting languages that even minimum wage, computer illiterate script kiddies can copy and paste spaghetti code for.

[@brostoevsky22]

kzbin.info/www/bejne/ZpuuYayqq8-pY6csi=n9BeRV1JsuCrxq0b

[@brostoevsky22]

What happened in the 80s stayed in the 80s except for Perl.

[@ddlc_monika]

People like me use PERL I went into IT wanting a website with 15 so HTML/CSS first, later on I wanted dynamic stuff so PHP it was. Fast forward to my second job, JavaScript was still something you use precisely on websites and nowhere else, and Python was still a weird mess with shit syntax nobody trusted, I needed something to take one XML as input and shit out another one, never heard of XSLT or XPath, all I knew was PHP and Regex. PERL came in clutch, I learned enough of it in like 10 minutes and immediately it just werked for me. Never used it outside of that due to my current job not giving us sysadmin to install software but man, in my old job I even got props from the local actual programmers because most of them only did C# and were down the OOP Rabbit Hole to bad to be quickhacking little stuff. If you want to survive in the rapidly evolving tech landscape outside of FAGMAN you'll be surprised how much legacy shit you will inevitably find, how useful powerful text handling can be and how very much in demand older stuff still is, because all the systems in most bigger companies are a legacy crap festival. If you hate learning a new framework every week, go into finance, banking, aviation or traffic control.

[@heroslippy6666]

@@brostoevsky22 Is this encryption? No its a new perl script I've been working on

[@Remigrator]

I code in PHP for 20 years now and I cannot remember a time when PHP was NOT vulnerable 🤣

[@blb8738]

Hey. Does this vulnerability require the PHP code to explicitly convert from one charset to another? So if a website just expects user input to be in UTF8 , it's safe. Just don't use mb_convert_encoding function that's enough right?

[@hthring]

php for life bro

[@marcogenovesi8570]

it's a feature not a bug. Job Security

[@hcbs1986]

PHP Numero Uno

[@SGresponse]

If it's a common LAMP vulnerability, then I bet you there's gonna be a no-brain-to-use script to do the hack 1 day after the talk goes live and a crawler 3 hours afterwards scrounging for visibile servers that are not updated and it will find MILLIONS of servers to up-root and there might even be a botnet fight on the servers when one bot de-admins the other in a back-and-forth escalation.

[@wereisaly]

Im hyped

[@rnts08]

The dead internet is real 😂

[@nnnik3595]

Sure hope that updating all these package update I did on all our dockers and vms updated to the new glibc version.

[@SquaresToOvals]

War has become a series of proxy battles fought by AI

[@ET_AYY_LMAO]

Not at all, read the CVE. its a 4 byte overflow, when using iconv with a specific chinese encoding that is NEVER used in the west. Also why would the end user be in control of the encoding format for iconv? Realistically that would never happen, unless the site is a PHP sandbox.

[@jwmcq]

Alpine Linux is used in production a lot more than you'd think. You wouldn't run a server on it, but the small size makes it great for init / sidecar containers in a kubernetes workload, for instance.

[@vito2320]

You are born to deploy kubernetess clusters. Lol

[@Deliverygirl]

@@vito2320 It's the sysadmin equivalent of living in the pod and eating the bugs, you hate to see it.

[@schlickit628]

I don’t understand the negative responses to this. Less code means less surface area for vulnerabilities. It’s not just glibc, openrc and ash instead of systemd and bash. When you all set up a server do you need user services or array functionality in your shell, because I sure don’t.

[@charautreal]

Can we not have big software vulnerabilities... for 5 damn minutes?!

[@futuza]

Gotta stop writing code then

[@MissiFull]

no

[@stevengill1736]

Welcome to the singularity...

[@AttacMage]

I'll go add some unsafe eval() queries to my python code rq. just for you :)

[@Necessarius]

Welcome to our job; we all make code vulnerable. We just don't know when or with what language, but it could certainly be any of them.

[@Hepad_]

Don't care, still using vulnerable software for my critical operations.

[@carnivorebear6582]

Patches are for cowards

[@vaisakh_km]

🙃 let me check, give me your ip

[@theblankuser]

Hell yeah

[@DonVigaDeFierro]

You guys are silly, they're gonna be looking for SECURE data!

[@SIMULATAN]

No risk no fun

[@kazwalker764]

Alpine is commonly used in production, most shops using container based deployments that I've seen use it, most of those using k8s. It's also the default base image for Phoenix/Elixir apps.

[@bloodonthesnow]

can confirm - using it in containers on prod for years

[@xanderplayz3446]

And the default base Docker image of Gitea instances.

[@beowulf_of_wall_st]

I've been doing this for 4 or 5 years at least now

[@Kabodanki]

Except with solved DNS issues (ndots), alpine is very good. Widely used in production

[@Liminal_Simulacre]

I love to wake up to an email of the french public administration warning me that they are too stupid to practice good opsec and now my social security number, name , email and so on are for sale.

[@rusi6219]

I mean your president is a gay who "married" a man who molested him as a child so no wonder

[@bosch5303]

I work in french medical sector and most of it relies on outdated and insecure technologies from around 2000s :)

[@alainportant6412]

why didnt I get one

[@charlesp.8555]

I clicked on the link in that email to "read the best practices to protect myself". You have to select which case applies to you but "absolute incompétence from the administration" isn't an option.

[@hcbs1986]

Didn't this also happen to Guatemala or something? Scary

[@flamingspinach]

The escape sequences you talk about around 4:09 are not for indicating that the computer should convert to this character set, it's actually that the character set is constructed out of multiple swappable sub-charsets (called "planes") and the escape sequences are used to indicate that at that point in the text, the encoding is jumping from the current plane to a different one. See the wikipedia article on "ISO/IEC_2022", subsection "Other 7-bit versions", for more info.

[@alainportant6412]

nerd

[@a__duck]

I am so glad I can't do anything about this!

[@CGoody564]

Questioning the open-source model because bugs are actually being found is odd to me... That is the additional public scrutiny doing exactly what it's supposed to do. You know if these bugs weren't found, they'd still be there... You wanna find out the hard way, or do you wanna find out during "security month" as a part of a semi-collaborative effort to make shit better?

[@MrFram]

Even if you are to take FOSS CVEs as indicating a problem, we just had a windows issue like 2 weeks ago and instead of MS fixing it, the programming languages had to add workarounds to avoid triggering it, which tells you all you need to know

[@Binxalot]

seriously, this is the entire point of open source software and why it's so important for community involvement in software development. When it comes to Apple/MS your system gets hacked and you'll never know or know why.

[@jesusmods1]

Is like that movie where a kid deciphers some kind of goverment code and instead of making a better encoding algorithm they try to kill the child haha

[@QuantumKurator]

Best functional backdrop I have seen on youtube

[@Tracing0029]

Each time a PHP CVE drops PHP-chan appears in my feed.

[@luszczi]

Blue teams everywhere having a really shitty month.

[@rideroftheforce5245]

Red teams everywhere are about to have a field day

[@crusaderACR]

​@@rideroftheforce5245 what does this mean

[@rideroftheforce5245]

@@crusaderACR I was just saying that red team pen testers are going to have a lot of successful attacks on their clients in the near future with this vulnerability

[@bigmango202]

Can't wait until I get confirmation that my house has massive vulnerabilities and there's people living in my walla

[@polarfamily6222]

LAMP has been somewhat vulnerable in one way or another for quite a while now.

[@kidnamedfinger.productions]

I don't get why anybody would use php in 2024, go is a much better alternative for the backend, for frontend just use svelte.

[@holetarget4925]

IMAGINE HOW MAY WP SITE HAD BEEN BACKDOORED INT HE LAST 24 YEARS

[@MrCobalt]

Trust me, WordPress sites didn't need this bug to be considered insecure. WordPress has consistently been a security nightmare.

[@iiisaac1312]

They deserve it for using WP.

[@SGresponse]

Imagine how many will be after the talk. You can't expect them to UPDATE their servers? I mean that entails actually hiring a tech to do it! Expensive stuff.

[@socialkruption]

@@iiisaac1312 Wordpress bro here, I enjoy my lambo, don't mad.

[@holetarget4925]

@@SGresponse 70% of the web is build on Php….this a total car crash

[@gibrains]

What's good about it is that it's open source. When issues arise, we address them. It's completely open-something you can't rely on in proprietary modes. You don't even know if their software is vulnerable or not. Even when they update, you don't know what they're actually updating. #windows.

[@nectronomeflower4895]

Windows isn’t actually vulnerable to this bug lmao

[@rusi6219]

Boy oh boy if only the entire web was rewritten in rust am i right sisters?

[@100c0c]

😂

[@Alexagrigorieff]

With the runtime which calls this glibc function?

Rewrite Wordpress in Rust

[@MentalOutlaw]

Lol well that would save me from the difficult journey of rewriting my eCommerce site in Rust.

[@kidnamedfinger.productions]

​@@MentalOutlaw We need to fork rust to make the compiler punch devs into the balls every time they make a mistake, so that way they won't code any bugs even when writing in other languages (they most likely won't code at all tho)

[@spl45hz]

I will do that if you promise to port 30% of plugins

[@kidnamedfinger.productions]

@@_________________404 Lemme tell you something, almost every compiled programming language uses LLVM as it's backend mostly because it's good and let's you bind your code with other programming languages that use LLVM too. Rust has a compiler, but a frontend which checks your code, LLVM does the dirty work. It's not even about rust, I don't know why would you even comment that it's just stupid.

[@kidnamedfinger.productions]

@@_________________404 What's so good do you find about C++ compared to rust tho? Have you ever tried them or you just made up your opinion from some KZbin video and now yelling it everywhere?

[@Rodelero]

Your thumbnails bring joy to my heart Mental Outlaw😂!

[@jazzjohnson5260]

More vulnerabilities this month very fun

[@TheTubejunky]

PHP perl was some of the first script used for phishing attacks. Good to see it's still knocking at system doors

[@whamer100]

Cant wait for the first ever 11/10 to be announced for the first time and its that someone found a way to just take over the universe because someone's toaster had an exposed copper cable into the matrix

[@sleepysapphire2349]

That anime thumbnail caught my eye. I thought this was going to be a vtuber's video.

[@thefloridaman6527]

I installed a fixed version of glibc for Debian buster for our website host right away 😄 Thanks

[@MonochromeWench]

Web servers should just be able to say no, I only support utf8/utf16 and get rid of all the character set conversion nonsense server side, but the webservers are accommodating to what the browser asks for even if it far from appropriate for the site's content.

[@levvayner4509]

The known bugs is a SOP. Software is released with a list of known issues, that is developed as more people provide feedback. Teams will ensure any critical issues are fixed, but non-critical issues - especially ones that have workarounds, are often released.

[@StarryX0]

7:15 To be fair, the xz backdoor wouldn’t be discovered in windows for a long time, but it would probably wouldn’t be introduced from the first place.

[@gregoryvanny-is2of]

BSD desktop users just chilling on there own little island completly uneffected by any of this and watching everything burn with vulernblties

[@veritas7010]

alpine is used often in prod, it's a lightweight base image for docker

[@bunnicula3221]

Counter argument: All applications are vulnerable. Software security keeps honest people away, it ain't gonna last forever against skilled/dedicated hackers.

[@Deniil2000]

No, theoretically, software can be impenetrable

[@tishaak2800]

​​​@@Deniil2000but is in practicallity nearly impossible Doubt on would perfectly set everything up down to binary code and Electric components And even so, all it takes is a rare case of the suns radiation conviently changing that one 1/0 to mess it all up

[@isheamongus811]

7:30 one could notice it with low level system wide debugging but it would be likely only if someone was reverse engineering.

[@Xnoob545]

I read the title and my reaction was: "Well of course they are, this is PHP"

[@Ginfidel]

Moon runes? Of course. -Gandalf

[@dnoordink]

"Much quicker" 24 years later... good one!

[@SerenadeURA]

unless my reading comprehension is poor (a possibility) I believe this was discovered 24 years ago and only found to be truly exploitable 24 years later.

[@dnoordink]

@@anon8510 So your conclusion is he didn't get to the point quick enough? Attention is a rare commodity these days.

[@dnoordink]

@@anon8510 Also good non-committal username. Choose better.

[@dnoordink]

@@anon8510 because you care about my watching a video to the end

[@dnoordink]

@@anon8510 how short is your username? this is getting ridiculous. I made a quick funny comment on a video I didn't want to watch to the end, because I'm a developer that doesn't care about a lot of open source bullshit... and this continues. Game over.

[@streettrialsandstuff]

It's been like 10-15 years since last time I heard someone mention LAMP until today.

[@ShatteredQvartz]

Also, wtf with the Italian bots lmao

[@neptronix]

I don't use iconv in my applications ( i wrote the code, i know ). Not all PHP applications are vulnerable.

[@rangeispow]

Should I be concerned about the fact that KZbin app on my TV has suddenly changed to the Chinese character set?

[@alexiosangel2221]

he never sleeps, only edits

[@slateslavens]

_"Little Bobby Tables"_ -XKCD

[@robertdeckard2136]

Gentoo can optionally be set up with musl instead of glibc. Not sure how often this is done in practice however. I did my first Gentoo install only a few months ago.

[@zhon5311]

2024 is the year of the security vulnerabilities

[@WatFat]

114/366 year is unlocked

[@finlanderxx]

Year of obscure vulnerabilities. Like who converts characters from UCS4 to ISO-2022-CN-EXT or haves unstable packages in production or allowing everybody running CLI commands remotely

[@mawnkey]

I just wanna know who hooked ChatGPT up to metasploit and told it to go ham.

[@hthring]

also open source is more likely to have bugs found because people can analyse the code looking for vulnerabilities

[@amr3162]

2:08 alpine is not used in production? it's one of the most used distros used for docker containers

[@nathanoher4865]

Perhaps that’s what he meant? Maybe he means the hosting servers not containers

[@dfgdfg_]

Mental Outlaw, put some posters up, it'll make your space more cozy!

[@JRSofty]

It would be nice to know if it is possible to mitigate the problem at the PHP level when you don't control the underlying server and cannot update the linux. Yet everyone seems to be talking about this Critical CVE which ramps up the stress, but there doesn't seem to be a clear path for mitigation.

[@V3DT]

Even if you could prevent it in your PHP code, in most cases when have no control over the software on the host your using shared hosting. So even if you could prevent it in your code, everyone else running a site on the server would also have to make sure their code prevents it. Any decent company offering hosting should be keeping an eye out for exploits & updating the software ASAP when patches come out for severe bugs.

[@ShadowManceri]

Sounds like this would effect every app that uses system's iconv. Not really just PHP. So more of GNU issue.

[@dyto2287]

We were discussing pentest with one company on our system and some part of your system was still in PHP. I remember them saying - "We don't pentest PHP because it's insecure by default. Get rid of it first" 😂

[@GhiveciuMarian]

yeah, sure ... what is not secure about php? is really weird that most of todays servers are powered by php, and WP on top of php, yet they do not get hacked left and right

[@dyto2287]

@@GhiveciuMarian ...mOsT sErVeRs PoWeRed By pHp... 🥴 Having higher quantity of crap WP deployments doesn't mean that it's used more to serve actual http traffic.

[@F_Around_and_find_out]

Many vulnerabilities being discovered lately is a good thing, because they are being seen, they are being fixed, and best of all you as the common user can know all of this. Proprietary software? Unless the people there do a press release, you won't know a damn thing. And there is a chance that there are less eyes to discover weird activities in the code too.

[@Reelix]

glibc version checker (Older than 2.39 are vulnerable) #include #include int main (void) { puts (gnu_get_libc_version ()); return 0; } Save as test.c Run: gcc test.c -o test ./test

[@A1A.]

New kenny upload!!🎉 ✨You are our favourite/based/red pilled honey pot chanel ✨😝

[@pierrejoye]

for the record, php on windows runs very well. Perform well too. it is still more common to run on Linux, not because php does not work on windows, but less portable user apps. But most framework and as long as conventions are respected, zero issues.

[@karpfenboy]

what makes you say virtually any PHP application? From what i can tell an application needs to take untrusted user input in the iconv function.

[@deidara_8598]

This is the pinnacle of PIKE MATCHBOX

[@pierrejoye]

as a fix, in case .40 is not available. One can disable these encodings as well. Still best to update glibc if possible.

[@AmosThacker-Gwaltney-hy7tc]

I could be wrong but cursory Google searching shows that andres freund works for Microsoft and posgresql, meaning he contributes to open source but works under proprietary software leadershit?

[@nothingtoseehere449]

is it suspected that a PHP vulnerability is why nemesis market was busted

[@SteveWray]

Interesting that the ISO-2022-CN-EXT character set is mainly used for traditional Chinese eg Taiwan

[@beskamir5977]

April: Month of security vulnerabilities. I shudder to think what will be found on April 30th.

[@HaloWolf102]

What is this Affordable Connectivity Program (ACP) I keep hearing about?

[@FPVogel]

started the video watched half-way through, updated and rebooted all servers at 3am there we go not even billable hours :(

[@Ziphon]

Dude, we're having a whole month of April Fools.

[@by010]

I started my dev life as LAMP stack dev. Still returning to LAMP for small gigs every now and then

[@stevengill1736]

When a malware comes up that can break out of a virtual machine sandbox, then we're in for trouble!😊

[@gairisiuil]

It's happened before (for example, the time they exploited gpu passthroughs to get into the host's graphics driver)

[@Aranimda]

Spectre, rowhammer.

[@mawnkey]

I can still remember the conversation with my boss about Spectre. We immediately went to management on our DoD contract and got their cloud plans scuttled punctuated by "We told you so!"

[@ra2enjoyer708]

They already can detect if they run in a vm or not.

[@Aranimda]

@@mawnkey At that time I spent two hours figuring out why my Windows 7 got so slow after a DELL Precision 5820 BIOS update. Apparently, it was the stupid Spectre patch. I first reverted the BIOS update after I later discovered that the Spectre patch can be simply disabled in the Windows Registry, after which I flashed my BIOS again. Rather fast and vulnerable than slow and safe. No end user has ever been hacked by this anyway. It's a different story when you are a cloud farm.

[@Gameplayer55055]

We really need to rewrite that old gnu crap to rust with enhanced security

[@ivanyosifov2629]

7:52 glibc doesn't have 2.40 version!?

[@mattm3023]

Actually paused the video and updated, though unattended-upgrades already took care of it. If youre using Ubuntu 22 then libc6 2.35-0ubuntu3.7 (check with ldd --version) is fixed despite being "under" 2.39.

[@MentalOutlaw]

Same thing happened on based.win backend, confirmed it this weekend when I saw the open wall post

[@mattm3023]

​@@MentalOutlaw Yeah might be a good video, ensuring security updates are on auto. Also, I'm kind of embarrassed how much I use LAMP but man its so fast to deploy

[@khemmahato8420]

I found one site lost it control because of it. 3 days it is still down.

[@snowcloudshinobi]

24 years? something big must be going down for all this to be coming out now.

[@2kadrenojunkie]

you know, i swear this exact same bug has been brought up before, maybe more than once. anyone remember where? i remember like forever ago people got their panties in a knot over this character set allowing a overflow, then suddenly everyone stopped caring/fixed it by simply filtering the input data.

[@MrRecorder1]

0:10 I would like to point out that I hope and expect that we find critical vulnerabilities now and in the future for pretty much ever. It is the normal software development cycle to get audited and finding bugs. Nothing special in that sense has happened this month other than this regular process uncovering a professional actor trying to insert a backdoor into ssh!

[@anahatamelodeon]

glibc was updated on Debian this morning. My servers and home PC are up to date. This problem is already history as far as I'm concerned.

[@eqiliaaaa]

Quack it, I'm writing my own kernel, my own libc, my own drivers and my own damn programs.

[@retsim_x]

Write your own vulnerabilities. Take charge! Nice.

[@ra2enjoyer708]

Okay but how are you going to produce your own hardware?

[@elexbeats]

I think it will be a great content if you show a way to encrypt ur harddrive so even people who has physical acces to it can’t find the recovery keys to decrypt

[@hthring]

you'll allways be my baby php and lamp, not giving up on you

[@nikoladd]

In php you're not going to convert character sets normally. Especially from utf8 to other (ANSI) character sets. This was done with old sites 15-20y ago when unicode was not fully adopted yet. That's the point of unicode - you don't need to convert it anymore. Further you would not normally convert user input's character set, unless you have say a database in some other character set. Which you wouldn't normally nowadays. And the DB would usually do it, not PHP. Further you can't just trigger it from the outside. Further even if you take hold of PHP and get remote code execution working that doesn't give system privileges by itself. Such hacks are used to infect a system and use it for spam usually. So the attack surfaces are not as broad as you seem to think.

[@ravenecho2410]

Alpine is standard like min linux distro for docker and k8s?

[@riseandshinejp]

CIA NSA losing all their toys, they must have pissed someone off.

[@tavanogrim]

They are probably using ai to discover new toys as we speak

[@MissiFull]

@@tavanogrim no wonders, that could happen

[@brettlaw4346]

Probably not. These kinds of things have to happen or no one would believe the open source process is working.

[@rusi6219]

They're leaking all of this themselves. Conditioning people to accept Rust as a "safe and secure" Messiah. Then it'll be even easier to slide in backdoors when no one's looking.

[@bahshas]

like its not (((them))) """discovering""" all these vulnerabilities

[@Iceman259]

Hot bug summer

[@somerandomguy001]

"All PHP Applications are Vulnerable" *Surprised Pikachu face*

[@cosmochaosmaker]

PHP Dev: I live in an burning house. But because fire climbs always up. I'm living safe at the the bottom of the house. 🙅‍♂️

[@ViaScientifica]

I have a feeling some AI tool has been created and it is being used to find these vulnerabilities. These vulnerabilities are being found too often, too fast.

[@rusi6219]

They're leaking all of this themselves. Conditioning people to accept Rust as a "safe and secure" Messiah. Then it'll be even easier to slide in backdoors when no one's looking.

[@100c0c]

Just way more people now.

[@_________________404]

@@rusi6219 Just look at the people who are involved with rust, that alone is a reason to be skeptical about it.

[@xr.spedtech]

I'm pretty sure the CVE could work in rust ... It's not memory based so.

[@MrFram]

except it is (buffer overrun)

[@isheamongus811]

What is thr earliest affected version? The first public release?

[@TheMohawkNinja]

TFW it's not even a Chinese APT but literally just the Chinese character set that causes a massive security hole on the Internet.

[@shashitnak]

I wonder if the discovery of all the newly discovered bugs has something to do with AI tools getting better day by day

[@sethjets4687]

Maybe... just maybe that is the way nemesis market got seized?

[@Burbun]

Open source, you hear about the bug, there's a hundred people already trying to fix it, closed source, there's a hundred Lawyers already trying to hide the existence of the bug

[@Marty234]

Great video brother!

[@ChiEKKUsama]

Chinese characters? Again? I thought we already solved this problem with wchar and other wide character types

[@xparadoxical69]

Php didn't catch up

[@rezwhap]

We fixed it with UTF-8 being the de facto web encoding. But… legacy stuff.

[@This-Is-The-End]

WEN RUST IN PHP LIBS ?

[@nixnox4852]

I can't believe Wordpress has another critical vulnerability

[@CapoMasi]

Mental outlaw is literally the software dev version of kid cudi.